aide

AIDE (Advanced Intrusion Detection Environment) answers one question: has a file I trust been changed? aide --init reads every file its config watches and stores a fingerprint — size, owner, permissions and a content hash (SHA-256) — in a database: the baseline, taken while the host is known-good. aide --check recomputes those fingerprints and reports any that no longer match, as added, removed or changed entries, showing the old and new hash side by side. It is detection, not prevention: it tells you after the fact that /etc/ssh/sshd_config was altered, even if no scan was due. The config (--config) lists the files to watch and what to record for each.

aide command usage

aide --config=CONFIG --init
aide --config=CONFIG --check

Options

--config=/root/aide.conf

the config: which files to watch and what to record

--init

build the baseline database from the watched files

--check

compare the files to the baseline and report differences

--update

check, then write a fresh baseline (accept the current state)

aide examples

aide --config=/root/aide.conf --init

Records the known-good baseline of the watched files.

aide --config=/root/aide.conf --check

Reports any watched file that has changed since the baseline.

Reading the output

$ aide --config=/root/aide.conf --check
AIDE found differences between database and filesystem!!

Summary:
  Total number of entries:	3
  Changed entries:		1

Changed entries:
f   ...    .C.. . : /etc/ssh/sshd_config

File: /etc/ssh/sshd_config
 SHA256    : X06ukt6eJra5jN6sK5ZgarJo... | rQ9TA4it90jXzdSnOA6QwLja...

• found differences: at least one watched file no longer matches the baseline.
• Changed entries: 1: one file changed (others would be added or removed).
• The two SHA256 values are the baseline's and the file's now; they differ, so the file was altered.

Pitfalls

• AIDE detects, it does not prevent: the change has already happened when --check reports it.
• Take the baseline (--init) while the host is known-good, or you bake the tampering into it.
• A legitimate change (a real update) also shows as a difference: re-baseline with --update once you have vetted it.

Run it on real machines